feat(gui): system tray with opt-in close-to-tray setting

Add a StatusNotifierItem tray (ksni — pure-Rust over the zbus stack
notify-rust already pulls; only new crate is the pastey macro helper).
The icon reflects host/viewer status via its tooltip and offers
Show / Quit; it runs on its own thread, channel-wired to the egui app.

Add a Settings screen with a persisted toggle 'keep running in the tray
when I close the window' (config.toml [gui] close_to_tray), defaulting
OFF so the close button quits as users expect. When ON, closing hides
to the tray on X11 / minimizes on Wayland (which has no protocol to hide
a toplevel) and keeps any live stream running. If no tray is present the
close behaves normally, so the window can never be stranded.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Cargo.lock

@@ -242,7 +242,7 @@ dependencies = [
  "serde_repr",
  "tokio",
  "url",
- "zbus",
+ "zbus 4.4.0",
 ]
 
 [[package]]
@@ -269,6 +269,20 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "async-executor"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
+dependencies = [
+ "async-task",
+ "concurrent-queue",
+ "fastrand",
+ "futures-lite",
+ "pin-project-lite",
+ "slab",
+]
+
 [[package]]
 name = "async-io"
 version = "2.6.0"
@@ -711,7 +725,7 @@ dependencies = [
  "iana-time-zone",
  "num-traits",
  "serde",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -1893,8 +1907,8 @@ dependencies = [
  "libc",
  "log",
  "rustversion",
- "windows-link",
+ "windows-link 0.2.1",
- "windows-result",
+ "windows-result 0.4.1",
 ]
 
 [[package]]
@@ -1914,7 +1928,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
 dependencies = [
  "rustix 1.1.4",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -2385,7 +2399,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core",
+ "windows-core 0.62.2",
 ]
 
 [[package]]
@@ -2582,7 +2596,7 @@ dependencies = [
  "socket2",
  "widestring",
  "windows-registry",
- "windows-result",
+ "windows-result 0.4.1",
  "windows-sys 0.61.2",
 ]
 
@@ -2816,7 +2830,7 @@ dependencies = [
  "simd_cesu8",
  "thiserror 2.0.18",
  "walkdir",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -2888,6 +2902,19 @@ version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
 
+[[package]]
+name = "ksni"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7ca513d0be42df5edb485af9f44a12b2cb85af773d91c27dc796d1c58b78edc"
+dependencies = [
+ "futures-util",
+ "pastey",
+ "serde",
+ "tokio",
+ "zbus 5.15.0",
+]
+
 [[package]]
 name = "kurbo"
 version = "0.13.1"
@@ -2925,7 +2952,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
 dependencies = [
  "cfg-if",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -3053,6 +3080,18 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3d25b0e0b648a86960ac23b7ad4abb9717601dec6f66c165f5b037f3f03065f"
 
+[[package]]
+name = "mac-notification-sys"
+version = "0.6.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29a16783dd1a47849b8c8133c9cd3eb2112cfbc6901670af3dba47c8bbfb07d3"
+dependencies = [
+ "cc",
+ "objc2 0.6.4",
+ "objc2-foundation 0.3.2",
+ "time",
+]
+
 [[package]]
 name = "matchers"
 version = "0.2.0"
@@ -3363,8 +3402,8 @@ dependencies = [
  "tokio-util",
  "tracing",
  "web-sys",
- "windows",
+ "windows 0.62.2",
- "windows-result",
+ "windows-result 0.4.1",
  "wmi",
 ]
 
@@ -3480,6 +3519,20 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "notify-rust"
+version = "4.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50ff2e74231b72c832d82982193b417f230945be6bdb5575b251d941d31adb00"
+dependencies = [
+ "futures-lite",
+ "log",
+ "mac-notification-sys",
+ "serde",
+ "tauri-winrt-notification",
+ "zbus 5.15.0",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -3972,7 +4025,7 @@ dependencies = [
  "libc",
  "redox_syscall 0.5.18",
  "smallvec",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -3981,6 +4034,12 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
+[[package]]
+name = "pastey"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ee67f1008b1ba2321834326597b8e186293b049a023cdef258527550b9935b4"
+
 [[package]]
 name = "pem-rfc7468"
 version = "1.0.0"
@@ -4109,7 +4168,9 @@ dependencies = [
  "eframe",
  "iroh",
  "iroh-tickets",
+ "ksni",
  "nix 0.30.1",
+ "notify-rust",
  "pipewire",
  "serde",
  "serde_json",
@@ -4154,7 +4215,7 @@ checksum = "092791278e026273c1b65bbdcfbba3a300f2994c896bd01ab01da613c29c46f1"
 dependencies = [
  "base64",
  "indexmap",
- "quick-xml",
+ "quick-xml 0.39.4",
  "serde",
  "time",
 ]
@@ -4360,6 +4421,15 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
 
+[[package]]
+name = "quick-xml"
+version = "0.37.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.39.4"
@@ -5263,6 +5333,18 @@ version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df7f62577c25e07834649fc3b39fafdc597c0a3527dc1c60129201ccfcbaa50c"
 
+[[package]]
+name = "tauri-winrt-notification"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b1e66e07de489fe43a46678dd0b8df65e0c973909df1b60ba33874e297ba9b9"
+dependencies = [
+ "quick-xml 0.37.5",
+ "thiserror 2.0.18",
+ "windows 0.61.3",
+ "windows-version",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -5793,6 +5875,7 @@ checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
 dependencies = [
  "getrandom 0.4.2",
  "js-sys",
+ "serde_core",
  "wasm-bindgen",
 ]
 
@@ -6141,7 +6224,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c324a910fd86ebdc364a3e61ec1f11737d3b1d6c273c0239ee8ff4bc0d24b4a"
 dependencies = [
  "proc-macro2",
- "quick-xml",
+ "quick-xml 0.39.4",
  "quote",
 ]
 
@@ -6367,16 +6450,38 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
+[[package]]
+name = "windows"
+version = "0.61.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
+dependencies = [
+ "windows-collections 0.2.0",
+ "windows-core 0.61.2",
+ "windows-future 0.2.1",
+ "windows-link 0.1.3",
+ "windows-numerics 0.2.0",
+]
+
 [[package]]
 name = "windows"
 version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
 dependencies = [
- "windows-collections",
+ "windows-collections 0.3.2",
- "windows-core",
+ "windows-core 0.62.2",
- "windows-future",
+ "windows-future 0.3.2",
- "windows-numerics",
+ "windows-numerics 0.3.1",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
+dependencies = [
+ "windows-core 0.61.2",
 ]
 
 [[package]]
@@ -6385,7 +6490,20 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
 dependencies = [
- "windows-core",
+ "windows-core 0.62.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
 ]
 
 [[package]]
@@ -6396,9 +6514,20 @@ checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
  "windows-implement",
  "windows-interface",
- "windows-link",
+ "windows-link 0.2.1",
- "windows-result",
+ "windows-result 0.4.1",
- "windows-strings",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+ "windows-threading 0.1.0",
 ]
 
 [[package]]
@@ -6407,9 +6536,9 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
 dependencies = [
- "windows-core",
+ "windows-core 0.62.2",
- "windows-link",
+ "windows-link 0.2.1",
- "windows-threading",
+ "windows-threading 0.2.1",
 ]
 
 [[package]]
@@ -6434,20 +6563,36 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "windows-link"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-numerics"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+]
+
 [[package]]
 name = "windows-numerics"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
 dependencies = [
- "windows-core",
+ "windows-core 0.62.2",
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -6456,9 +6601,18 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
- "windows-result",
+ "windows-result 0.4.1",
- "windows-strings",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+dependencies = [
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -6467,7 +6621,16 @@ version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+dependencies = [
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -6476,7 +6639,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -6512,7 +6675,7 @@ version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -6546,13 +6709,31 @@ dependencies = [
  "windows_x86_64_msvc 0.52.6",
 ]
 
+[[package]]
+name = "windows-threading"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
 [[package]]
 name = "windows-threading"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
 dependencies = [
- "windows-link",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-version"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4060a1da109b9d0326b7262c8e12c84df67cc0dbc9e33cf49e01ccc2eb63631"
+dependencies = [
+ "windows-link 0.2.1",
 ]
 
 [[package]]
@@ -6828,8 +7009,8 @@ dependencies = [
  "log",
  "serde",
  "thiserror 2.0.18",
- "windows",
+ "windows 0.62.2",
- "windows-core",
+ "windows-core 0.62.2",
 ]
 
 [[package]]
@@ -6990,9 +7171,45 @@ dependencies = [
  "uds_windows",
  "windows-sys 0.52.0",
  "xdg-home",
- "zbus_macros",
+ "zbus_macros 4.4.0",
- "zbus_names",
+ "zbus_names 3.0.0",
- "zvariant",
+ "zvariant 4.2.0",
+]
+
+[[package]]
+name = "zbus"
+version = "5.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3bcbf15c8708d7fc1be0c993622e0a5cbd5e8b52bfa40afa4c3e0cd8d724ac1"
+dependencies = [
+ "async-broadcast",
+ "async-executor",
+ "async-io",
+ "async-lock",
+ "async-process",
+ "async-recursion",
+ "async-task",
+ "async-trait",
+ "blocking",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-lite",
+ "hex",
+ "libc",
+ "ordered-stream",
+ "rustix 1.1.4",
+ "serde",
+ "serde_repr",
+ "tokio",
+ "tracing",
+ "uds_windows",
+ "uuid",
+ "windows-sys 0.61.2",
+ "winnow",
+ "zbus_macros 5.15.0",
+ "zbus_names 4.3.2",
+ "zvariant 5.11.0",
 ]
 
 [[package]]
@@ -7005,7 +7222,22 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn",
- "zvariant_utils",
+ "zvariant_utils 2.1.0",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "5.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51fa5406ad9175a8c825a931f8cf347116b531b3634fcb0b627c290f1f2516ff"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "zbus_names 4.3.2",
+ "zvariant 5.11.0",
+ "zvariant_utils 3.3.1",
 ]
 
 [[package]]
@@ -7016,7 +7248,18 @@ checksum = "4b9b1fef7d021261cc16cba64c351d291b715febe0fa10dc3a443ac5a5022e6c"
 dependencies = [
  "serde",
  "static_assertions",
- "zvariant",
+ "zvariant 4.2.0",
+]
+
+[[package]]
+name = "zbus_names"
+version = "4.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7074f3e50b894eac91750142016d30d0a89be8e67dbfd9704fb875825760e52d"
+dependencies = [
+ "serde",
+ "winnow",
+ "zvariant 5.11.0",
 ]
 
 [[package]]
@@ -7145,7 +7388,21 @@ dependencies = [
  "serde",
  "static_assertions",
  "url",
- "zvariant_derive",
+ "zvariant_derive 4.2.0",
+]
+
+[[package]]
+name = "zvariant"
+version = "5.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c1567a6ec68df868cbbfde844cfc6d81649fe5109a62b116b19fabd53e618ee"
+dependencies = [
+ "endi",
+ "enumflags2",
+ "serde",
+ "winnow",
+ "zvariant_derive 5.11.0",
+ "zvariant_utils 3.3.1",
 ]
 
 [[package]]
@@ -7158,7 +7415,20 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn",
- "zvariant_utils",
+ "zvariant_utils 2.1.0",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "5.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7d5b780599bbde114e39d9a0799577fad1ced5105d38515745f7b3099d8ceda"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "zvariant_utils 3.3.1",
 ]
 
 [[package]]
@@ -7171,3 +7441,16 @@ dependencies = [
  "quote",
  "syn",
 ]
+
+[[package]]
+name = "zvariant_utils"
+version = "3.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d464f5733ffa07a3164d656f18533caace9d0638596721355d73256a410d691"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn",
+ "winnow",
+]

Cargo.toml

@@ -34,6 +34,12 @@ ureq = { version = "3", default-features = false, features = ["rustls"] }
 toml = "1"
 chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
 eframe = { version = "0.34.2", default-features = false, features = ["glow", "default_fonts", "wayland", "x11"], optional = true }
+# Desktop notifications on viewer join/leave. Default features give the
+# pure-Rust zbus backend (no system libdbus, no image crate).
+notify-rust = { version = "4", optional = true }
+# System-tray icon (StatusNotifierItem over D-Bus). Pure-Rust, riding the same
+# zbus stack notify-rust already pulls — no GTK, no libappindicator/C libdbus.
+ksni = { version = "0.3", optional = true }
 
 [profile.release]
 lto = "thin"
@@ -43,4 +49,4 @@ strip = "symbols"
 [features]
 # Opt-in graphical front-end (pixelpass --gui). Default-off so the headless
 # build never pulls the GUI toolkit tree.
-gui = ["dep:eframe"]
+gui = ["dep:eframe", "dep:notify-rust", "dep:ksni"]

LICENSE-APACHE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 mollusk
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mollusk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -83,8 +83,9 @@ pixelpass --gui
 ```
 
 Host: pick quality / max-viewers / options, click **Start hosting**, and the
-share code appears with a copy button alongside a live viewer count. View:
+share code appears with a copy button. Connected viewers are listed with a
-paste a code, pick mpv or VLC, click **Connect** and the player launches.
+**Kick** button each, and a desktop notification fires as they join or leave.
+View: paste a code, pick mpv or VLC, click **Connect** and the player launches.
 
 The window is a thin driver — it runs the same headless `pixelpass` as a
 child process and reads its event stream, so the GUI is purely additive and

assets/pixelpass.desktop

@@ -0,0 +1,12 @@
+[Desktop Entry]
+Type=Application
+Name=pixelpass
+GenericName=Screen Sharing
+Comment=P2P screen sharing over iroh — no port forwarding, no signup
+Exec=pixelpass --gui
+Icon=pixelpass
+StartupWMClass=pixelpass
+Terminal=false
+Categories=Network;RemoteAccess;
+Keywords=screen;share;sharing;remote;p2p;iroh;cast;
+StartupNotify=true

assets/pixelpass.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="256" height="256" viewBox="0 0 256 256">
+  <title>pixelpass</title>
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="256" y2="256" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#4338ca"/>
+      <stop offset="1" stop-color="#7c3aed"/>
+    </linearGradient>
+  </defs>
+  <rect x="8" y="8" width="240" height="240" rx="56" fill="url(#bg)"/>
+  <!-- pixel stream: squares fading cyan -> white, "passed" toward the arrow -->
+  <rect x="50.25" y="181.29" width="16" height="16" rx="3.2" fill="#2dd5ef"/>
+  <rect x="67" y="124.44" width="20" height="20" rx="4" fill="#62dff2"/>
+  <rect x="96.25" y="82.09" width="24" height="24" rx="4.8" fill="#98e8f6"/>
+  <rect x="134.04" y="55.77" width="28" height="28" rx="5.6" fill="#c9f1f9"/>
+  <path d="M 225.5 57.5 L 183.1 85.8 L 176.9 42.2 Z" fill="#f8fafc"/>
+</svg>

packaging/arch/.gitignore

@@ -0,0 +1,6 @@
+# makepkg build artifacts
+src/
+pkg/
+/pixelpass/
+*.pkg.tar.*
+*.log

packaging/arch/PKGBUILD

@@ -0,0 +1,63 @@
+# Maintainer: mollusk <jitty+lc1iz0dc@protonmail.com>
+#
+# Local versioned package, built from the local git repo on `main`.
+# For a tagged release, switch the source fragment to `#tag=v0.1.0`.
+
+pkgname=pixelpass
+pkgver=0.1.0
+pkgrel=1
+pkgdesc='P2P screen sharing over iroh — no port forwarding, no signup'
+arch=('x86_64')
+url='file:///home/mollusk/git/butter/pixelpass'
+license=('MIT' 'Apache-2.0')
+depends=(
+  'gstreamer'          # gst-launch-1.0 / gst-inspect-1.0
+  'gst-plugins-base'   # videoscale (quality-preset downscale)
+  'gst-plugins-good'   # ximagesrc (X11 capture) + pulsesrc
+  'gst-plugins-bad'    # h264parse, mpegtsmux, aacparse
+  'gst-libav'          # avenc_aac (audio encode)
+  'gst-plugin-va'      # vah264enc (default hardware H.264 encoder)
+  'libpulse'           # pactl (audio routing / device control)
+  'hicolor-icon-theme' # owns the scalable icon dir
+  'libglvnd'           # libGL for the egui (glow) GUI
+  'libxkbcommon'       # GUI keyboard handling (winit)
+  'wayland'            # GUI Wayland backend libs
+)
+optdepends=(
+  'mpv: recommended stream viewer (the GUI launches mpv)'
+  'vlc: alternative stream viewer'
+  'gst-plugins-ugly: software x264 encoding for `pixelpass --no-hwencode`'
+  'gst-plugin-pipewire: screen capture on Wayland sessions'
+  'xorg-xwininfo: share a single window on X11 (`pixelpass --window`)'
+)
+makedepends=('cargo' 'git')
+options=('!lto')
+_branch='main'
+source=("$pkgname::git+file:///home/mollusk/git/butter/pixelpass#branch=$_branch")
+sha256sums=('SKIP')
+
+prepare() {
+  cd "$srcdir/$pkgname"
+  export RUSTUP_TOOLCHAIN=stable
+  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
+}
+
+build() {
+  cd "$srcdir/$pkgname"
+  export RUSTUP_TOOLCHAIN=stable
+  export CARGO_TARGET_DIR=target
+  # --features gui so the .desktop launcher (pixelpass --gui) works.
+  cargo build --frozen --release --features gui
+}
+
+package() {
+  cd "$srcdir/$pkgname"
+  install -Dm0755 "target/release/$pkgname" "$pkgdir/usr/bin/$pkgname"
+  install -Dm0644 assets/pixelpass.desktop \
+    "$pkgdir/usr/share/applications/$pkgname.desktop"
+  install -Dm0644 assets/pixelpass.svg \
+    "$pkgdir/usr/share/icons/hicolor/scalable/apps/$pkgname.svg"
+  install -Dm0644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
+  install -Dm0644 LICENSE-MIT "$pkgdir/usr/share/licenses/$pkgname/LICENSE-MIT"
+  install -Dm0644 LICENSE-APACHE "$pkgdir/usr/share/licenses/$pkgname/LICENSE-APACHE"
+}

src/common/config.rs

@@ -1,8 +1,7 @@
 //! Persistent user-level config at `~/.config/pixelpass/config.toml`.
 //!
-//! Right now this only tracks the bandwidth pre-flight result. Future
+//! It tracks the bandwidth pre-flight result and the GUI's preferences.
-//! preferences (default player, default bitrate, etc.) can hang off the
+//! Further settings can hang off the same file under their own `[section]`.
-//! same file under their own `[section]`.
 
 use anyhow::{Context, Result};
 use chrono::{DateTime, Utc};
@@ -16,6 +15,18 @@ use std::path::PathBuf;
 pub struct Config {
     #[serde(default)]
     pub bandwidth: BandwidthEntry,
+    #[serde(default)]
+    pub gui: GuiSettings,
+}
+
+/// Preferences for the `pixelpass --gui` front-end.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct GuiSettings {
+    /// When true, the window's close button hides the app to the system tray
+    /// (keeping any live stream running) instead of quitting. Defaults to
+    /// false — closing quits, which is what people expect.
+    #[serde(default)]
+    pub close_to_tray: bool,
 }
 
 /// Result of the first-run upstream measurement.
@@ -37,18 +48,15 @@ pub struct BandwidthEntry {
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]
+#[derive(Default)]
 pub enum BandwidthStatus {
+    #[default]
     Unmeasured,
     Measured,
     Skipped,
     Failed,
 }
 
-impl Default for BandwidthStatus {
-    fn default() -> Self {
-        Self::Unmeasured
-    }
-}
 
 fn default_status() -> BandwidthStatus {
     BandwidthStatus::Unmeasured

src/common/output.rs

@@ -22,7 +22,11 @@ pub fn set_json(enabled: bool) {
     JSON_ENABLED.store(enabled, Ordering::Relaxed);
 }
 
-fn json_enabled() -> bool {
+/// Whether the JSON event stream is on — i.e. we're being driven by a
+/// machine front-end (the `--gui` shell-out) rather than a human terminal.
+/// Gates features that only make sense under that front-end, like the
+/// stdin command channel the host reads `kick` requests from.
+pub fn json_enabled() -> bool {
     JSON_ENABLED.load(Ordering::Relaxed)
 }
 
@@ -42,8 +46,12 @@ pub enum Event<'a> {
         max_viewers: u32,
         max_viewers_source: &'a str,
     },
-    /// Active viewer count changed.
+    /// A viewer joined. `id` is the viewer's endpoint id; `active` is the new
-    ViewerCount { active: u32, max: u32 },
+    /// total after the join.
+    ViewerJoined { id: &'a str, active: u32, max: u32 },
+    /// A viewer left — disconnected on their own or kicked by the host. `id`
+    /// is the viewer's endpoint id; `active` is the new total after.
+    ViewerLeft { id: &'a str, active: u32, max: u32 },
     /// Capture pipeline lifecycle (spawned on first viewer, torn down on last).
     Capture { state: CaptureState },
     /// A viewer was turned away (host full, or capture spawn failed).

src/gui/child.rs

@@ -6,8 +6,8 @@
 //! egui app drains each frame. stderr is captured into a small ring so a
 //! failed launch (e.g. a missing gst plugin) can be surfaced in the window.
 
-use std::io::{BufRead, BufReader};
+use std::io::{BufRead, BufReader, Write};
-use std::process::{Child, Command, Stdio};
+use std::process::{Child, ChildStdin, Command, Stdio};
 use std::sync::mpsc::Receiver;
 use std::sync::{Arc, Mutex};
 use std::time::Duration;
@@ -35,7 +35,13 @@ pub enum ChildEvent {
         max_viewers: u32,
         max_viewers_source: String,
     },
-    ViewerCount {
+    ViewerJoined {
+        id: String,
+        active: u32,
+        max: u32,
+    },
+    ViewerLeft {
+        id: String,
         active: u32,
         max: u32,
     },
@@ -60,9 +66,14 @@ pub enum CaptureState {
 const STDERR_TAIL_MAX: usize = 60;
 
 pub struct ChildProc {
-    child: Child,
+    /// `Some` while the child is owned here; `Drop` takes it to hand off to a
+    /// detached reaper thread (see the `Drop` impl).
+    child: Option<Child>,
     pub rx: Receiver<ChildEvent>,
     stderr_tail: Arc<Mutex<Vec<String>>>,
+    /// Write end of the child's stdin, for the line-based command channel
+    /// (see [`ChildProc::send_command`]). `None` once it's been closed.
+    stdin: Option<ChildStdin>,
 }
 
 impl ChildProc {
@@ -72,11 +83,14 @@ impl ChildProc {
         let exe = std::env::current_exe()?;
         let mut child = Command::new(exe)
             .args(args)
-            .stdin(Stdio::null())
+            // Piped so we can send line commands (e.g. `kick <id>`); the host
+            // only reads it when driven this way (`--output json`).
+            .stdin(Stdio::piped())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped())
             .spawn()?;
 
+        let stdin = child.stdin.take();
         let (tx, rx) = std::sync::mpsc::channel();
         let stdout = child.stdout.take().expect("stdout piped");
         std::thread::spawn(move || {
@@ -111,46 +125,64 @@ impl ChildProc {
         });
 
         Ok(Self {
-            child,
+            child: Some(child),
             rx,
             stderr_tail,
+            stdin,
         })
     }
 
+    /// Send one newline-terminated command to the child over its stdin (the
+    /// host parses these as `kick <endpoint-id>`). Best-effort: a closed pipe
+    /// (child already gone) just drops the command.
+    pub fn send_command(&mut self, cmd: &str) {
+        let Some(stdin) = self.stdin.as_mut() else {
+            return;
+        };
+        if let Err(e) = writeln!(stdin, "{cmd}") {
+            tracing::warn!("failed to send command to host child: {e}");
+            self.stdin = None; // pipe is dead; stop trying
+        }
+    }
+
     /// Whether the child is still running.
     pub fn is_alive(&mut self) -> bool {
-        matches!(self.child.try_wait(), Ok(None))
+        matches!(self.child.as_mut().map(Child::try_wait), Some(Ok(None)))
     }
 
     /// The last captured stderr lines, joined — for error display.
     pub fn stderr_tail(&self) -> String {
         self.stderr_tail.lock().unwrap().join("\n")
     }
-
-    /// Gracefully stop the child: SIGINT (so the host runs its ctrl-c teardown
-    /// — tears down capture, closes the endpoint), with a ~2 s grace period
-    /// before a hard kill. Idempotent.
-    pub fn stop(&mut self) {
-        if matches!(self.child.try_wait(), Ok(Some(_))) {
-            return; // already exited
-        }
-        let _ = kill(Pid::from_raw(self.child.id() as i32), Signal::SIGINT);
-        for _ in 0..40 {
-            if matches!(self.child.try_wait(), Ok(Some(_))) {
-                return;
-            }
-            std::thread::sleep(Duration::from_millis(50));
-        }
-        let _ = self.child.kill();
-        let _ = self.child.wait();
-    }
 }
 
 impl Drop for ChildProc {
     fn drop(&mut self) {
-        // Closing the window (dropping the app, hence the session) must not
+        // Leaving a host/viewer screen, or closing the window, must not orphan
-        // orphan a live host child streaming to viewers.
+        // a live child — but it must also not *block*. eframe runs this drop
-        self.stop();
+        // synchronously while it destroys the window, so a grace-period wait
+        // here freezes the window mid-close: the first click looks like it did
+        // nothing (the stream just drops) and the window only goes away on a
+        // second click. So SIGINT now — synchronously, so the host always gets
+        // its ctrl-c teardown (capture down, endpoint closed) even if we exit
+        // right after — then reap on a detached thread instead of waiting.
+        let Some(mut child) = self.child.take() else {
+            return;
+        };
+        if matches!(child.try_wait(), Ok(Some(_))) {
+            return; // already exited; nothing to signal or reap
+        }
+        let _ = kill(Pid::from_raw(child.id() as i32), Signal::SIGINT);
+        std::thread::spawn(move || {
+            for _ in 0..40 {
+                if matches!(child.try_wait(), Ok(Some(_))) {
+                    return;
+                }
+                std::thread::sleep(Duration::from_millis(50));
+            }
+            let _ = child.kill();
+            let _ = child.wait();
+        });
     }
 }
 
@@ -205,10 +237,14 @@ mod tests {
     }
 
     #[test]
-    fn viewer_count_round_trips() {
+    fn viewer_join_leave_round_trip() {
         assert!(matches!(
-            parse(Event::ViewerCount { active: 2, max: 4 }),
+            parse(Event::ViewerJoined { id: "nodeXYZ", active: 2, max: 4 }),
-            ChildEvent::ViewerCount { active: 2, max: 4 }
+            ChildEvent::ViewerJoined { id, active: 2, max: 4 } if id == "nodeXYZ"
+        ));
+        assert!(matches!(
+            parse(Event::ViewerLeft { id: "nodeXYZ", active: 1, max: 4 }),
+            ChildEvent::ViewerLeft { id, active: 1, max: 4 } if id == "nodeXYZ"
         ));
     }
 

src/gui/mod.rs

@@ -10,26 +10,42 @@
 //! the GUI can be closed or crash without taking a live stream down.
 
 mod child;
+mod tray;
 
 use eframe::egui;
 
 use self::child::{ChildEvent, ChildProc};
+use self::tray::{TrayAction, TrayHandle, TrayStatus};
 
 /// Launch the GUI event loop. Blocks until the window is closed. Runs on the
 /// main thread (a winit requirement), which is where `main` calls it from.
 pub fn run() -> anyhow::Result<()> {
+    // `app_id` must match the installed `pixelpass.desktop`: on Wayland the
+    // compositor sources the titlebar/taskbar icon from that desktop file's
+    // `Icon=` keyed by app_id — not from any pixels the app sets.
+    let mut viewport = egui::ViewportBuilder::default()
+        .with_app_id("pixelpass")
+        .with_inner_size([520.0, 480.0])
+        .with_min_inner_size([460.0, 380.0])
+        .with_title("PixelPass");
+
+    // Pixel icon for X11 titlebars (`_NET_WM_ICON`), embedded at compile time
+    // so the single binary stays self-contained. Non-fatal on failure: Wayland
+    // already has its icon via app_id, and X11 just keeps the generic fallback.
+    match eframe::icon_data::from_png_bytes(include_bytes!("../../assets/pixelpass-256.png")) {
+        Ok(icon) => viewport = viewport.with_icon(icon),
+        Err(e) => tracing::warn!("could not load embedded window icon: {e}"),
+    }
+
     let options = eframe::NativeOptions {
-        viewport: egui::ViewportBuilder::default()
+        viewport,
-            .with_inner_size([520.0, 480.0])
-            .with_min_inner_size([460.0, 380.0])
-            .with_title("PixelPass"),
         ..Default::default()
     };
 
     eframe::run_native(
         "PixelPass",
         options,
-        Box::new(|_cc| Ok(Box::new(PixelPassApp::default()))),
+        Box::new(|cc| Ok(Box::new(PixelPassApp::new(cc.egui_ctx.clone())))),
     )
     .map_err(|e| anyhow::anyhow!("GUI failed to start: {e}"))
 }
@@ -78,6 +94,34 @@ fn short_id(id: &str) -> String {
     }
 }
 
+/// Fire a desktop notification, on a detached thread so the D-Bus round-trip
+/// can't stall the egui frame. Best-effort: with no notification daemon it
+/// just does nothing. (notify-rust talks D-Bus via pure-Rust zbus, so this
+/// needs no system libdbus and no GTK event loop.)
+fn notify(summary: &'static str, body: String) {
+    std::thread::spawn(move || {
+        if let Err(e) = notify_rust::Notification::new()
+            .appname("PixelPass")
+            .summary(summary)
+            .body(&body)
+            .show()
+        {
+            tracing::warn!("desktop notification failed: {e}");
+        }
+    });
+}
+
+/// Persist just the close-to-tray preference, preserving the rest of the
+/// on-disk config (e.g. the bandwidth section the headless child may have
+/// written). Best-effort: a write failure is logged, not surfaced.
+fn persist_close_to_tray(value: bool) {
+    let mut cfg = crate::common::config::load().unwrap_or_default();
+    cfg.gui.close_to_tray = value;
+    if let Err(e) = crate::common::config::save(&cfg) {
+        tracing::warn!("failed to save settings: {e}");
+    }
+}
+
 /// Which screen the single window is currently showing.
 #[derive(Default, PartialEq)]
 enum Screen {
@@ -85,6 +129,7 @@ enum Screen {
     Menu,
     Host,
     Viewer,
+    Settings,
 }
 
 /// Quality preset choices, mirroring `cli::Quality`. Map to the `--quality`
@@ -148,6 +193,7 @@ impl PlayerSel {
 
 /// Host-screen state: the config form fields plus, once started, the running
 /// child and the latest values parsed from its event stream.
+#[derive(Default)]
 struct HostState {
     // form
     quality: QualitySel,
@@ -168,26 +214,9 @@ struct HostState {
     copied: bool,
     last_refusal: Option<String>,
     error: Option<String>,
-}
+    /// Endpoint ids of the currently-connected viewers, in arrival order.
-
+    /// Drives the per-viewer list and its Kick buttons.
-impl Default for HostState {
+    viewers: Vec<String>,
-    fn default() -> Self {
-        Self {
-            quality: QualitySel::default(),
-            max_viewers: 0,
-            no_hwencode: false,
-            window: false,
-            proc: None,
-            ticket: None,
-            info: None,
-            active: 0,
-            max: 0,
-            capturing: false,
-            copied: false,
-            last_refusal: None,
-            error: None,
-        }
-    }
 }
 
 /// The host config summary echoed back by the child's `host_info` event.
@@ -222,24 +251,113 @@ struct PixelPassApp {
     screen: Screen,
     host: HostState,
     viewer: ViewerState,
+    /// System-tray handle; `None` if the tray couldn't start, in which case the
+    /// window behaves normally (no minimize-to-tray).
+    tray: Option<TrayHandle>,
+    /// winit can't truly hide a Wayland toplevel, so close-to-tray iconifies
+    /// there and fully hides on X11.
+    is_wayland: bool,
+    /// Set by the tray's "Quit" item so the next close really exits — the
+    /// window's own close button only hides to the tray.
+    really_quit: bool,
+    /// Persisted preference: when true, the close button hides to the tray
+    /// instead of quitting. Loaded at startup, written on toggle in Settings.
+    close_to_tray: bool,
 }
 
 impl eframe::App for PixelPassApp {
     // eframe 0.34 hands us the central-panel `ui` directly.
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
+        // Tray clicks + close-to-tray come first, before any drawing.
+        let ctx = ui.ctx().clone();
+        self.handle_tray(&ctx);
         // Drain any pending child events before drawing this frame.
         self.pump_host_events();
         self.pump_viewer_events();
+        // Reflect the resulting host/viewer state into the tray icon.
+        self.sync_tray_status();
 
         match self.screen {
             Screen::Menu => self.menu(ui),
             Screen::Host => self.host(ui),
             Screen::Viewer => self.viewer(ui),
+            Screen::Settings => self.settings(ui),
         }
     }
 }
 
 impl PixelPassApp {
+    /// Build the app and start the tray with the live egui context (needed so
+    /// tray clicks can wake a hidden/minimized window).
+    fn new(ctx: egui::Context) -> Self {
+        let close_to_tray = crate::common::config::load()
+            .map(|c| c.gui.close_to_tray)
+            .unwrap_or(false);
+        Self {
+            tray: tray::start(ctx),
+            is_wayland: std::env::var_os("WAYLAND_DISPLAY").is_some(),
+            close_to_tray,
+            ..Default::default()
+        }
+    }
+
+    /// Drain tray actions and divert the window's close button to the tray
+    /// (keeping any live host stream running) instead of quitting.
+    fn handle_tray(&mut self, ctx: &egui::Context) {
+        let actions: Vec<TrayAction> = match &self.tray {
+            Some(t) => std::iter::from_fn(|| t.actions.try_recv().ok()).collect(),
+            None => Vec::new(),
+        };
+        for action in actions {
+            match action {
+                TrayAction::Show => {
+                    // Restore from whichever hide path this backend used, then
+                    // raise. The no-op one of these two is harmless.
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(false));
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Visible(true));
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Focus);
+                }
+                TrayAction::Quit => {
+                    self.really_quit = true;
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Close);
+                }
+            }
+        }
+
+        // Only divert the close when a tray is actually showing our icon —
+        // otherwise hiding would strand the window with no way to get it back.
+        let tray_live = self.tray.as_ref().is_some_and(TrayHandle::registered);
+        if tray_live
+            && self.close_to_tray
+            && !self.really_quit
+            && ctx.input(|i| i.viewport().close_requested())
+        {
+            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
+            if self.is_wayland {
+                ctx.send_viewport_cmd(egui::ViewportCommand::Minimized(true));
+            } else {
+                ctx.send_viewport_cmd(egui::ViewportCommand::Visible(false));
+            }
+        }
+    }
+
+    /// Mirror current activity into the tray icon's tooltip/menu.
+    fn sync_tray_status(&mut self) {
+        let status = if self.host.proc.is_some() {
+            TrayStatus::Hosting {
+                active: self.host.active,
+                max: self.host.max,
+            }
+        } else if self.viewer.proc.is_some() {
+            TrayStatus::Viewing
+        } else {
+            TrayStatus::Idle
+        };
+        if let Some(tray) = &mut self.tray {
+            tray.set_status(status);
+        }
+    }
+
     fn menu(&mut self, ui: &mut egui::Ui) {
         ui.vertical_centered(|ui| {
             ui.add_space(24.0);
@@ -268,9 +386,52 @@ impl PixelPassApp {
                 self.screen = Screen::Viewer;
                 self.prefill_viewer_ticket();
             }
+            ui.add_space(20.0);
+            if ui.button("⚙ Settings").clicked() {
+                self.screen = Screen::Settings;
+            }
         });
     }
 
+    fn settings(&mut self, ui: &mut egui::Ui) {
+        ui.horizontal(|ui| {
+            if ui.button("← Menu").clicked() {
+                self.screen = Screen::Menu;
+            }
+            ui.heading("Settings");
+        });
+        ui.separator();
+        ui.add_space(4.0);
+
+        let resp = ui.checkbox(
+            &mut self.close_to_tray,
+            "Keep running in the tray when I close the window",
+        );
+        if resp.changed() {
+            persist_close_to_tray(self.close_to_tray);
+        }
+
+        ui.add_space(4.0);
+        ui.label(
+            egui::RichText::new(
+                "Off: closing the window quits PixelPass.\n\
+                 On: closing hides it to the system tray and any active stream \
+                 keeps running — reopen it from the tray icon.",
+            )
+            .small()
+            .weak(),
+        );
+
+        // The option does nothing without a tray to hide into; say so plainly.
+        if !self.tray.as_ref().is_some_and(TrayHandle::registered) {
+            ui.add_space(8.0);
+            ui.colored_label(
+                egui::Color32::from_rgb(220, 160, 60),
+                "⚠ No system tray detected — this option has no effect right now.",
+            );
+        }
+    }
+
     // ── Host screen ──────────────────────────────────────────────────────
 
     fn host(&mut self, ui: &mut egui::Ui) {
@@ -362,6 +523,23 @@ impl PixelPassApp {
         ui.add_space(6.0);
         ui.label(format!("Viewers: {} / {}", self.host.active, self.host.max));
 
+        // Per-viewer list with a Kick button each. Collect the click first so
+        // we're not borrowing self.host.viewers while we reach for the child.
+        let mut kick: Option<String> = None;
+        for id in &self.host.viewers {
+            ui.horizontal(|ui| {
+                ui.label(format!("• endpoint {}", short_id(id)));
+                if ui.small_button("Kick").clicked() {
+                    kick = Some(id.clone());
+                }
+            });
+        }
+        if let Some(id) = kick
+            && let Some(p) = &mut self.host.proc
+        {
+            p.send_command(&format!("kick {id}"));
+        }
+
         if let Some(info) = &self.host.info {
             ui.label(
                 egui::RichText::new(format!("{} · {}", info.display, info.capture))
@@ -452,6 +630,7 @@ impl PixelPassApp {
         self.host.max = 0;
         self.host.capturing = false;
         self.host.copied = false;
+        self.host.viewers.clear();
 
         let mut args = vec![
             "--host".to_string(),
@@ -483,6 +662,7 @@ impl PixelPassApp {
         self.host.capturing = false;
         self.host.ticket = None;
         self.host.copied = false;
+        self.host.viewers.clear();
     }
 
     /// Drain the host child's event channel into state, and detect an
@@ -543,9 +723,27 @@ impl PixelPassApp {
                     cap_source: max_viewers_source,
                 });
             }
-            ChildEvent::ViewerCount { active, max } => {
+            ChildEvent::ViewerJoined { id, active, max } => {
                 self.host.active = active;
                 self.host.max = max;
+                if !self.host.viewers.contains(&id) {
+                    notify(
+                        "PixelPass — viewer connected",
+                        format!("endpoint {} is now watching ({active}/{max})", short_id(&id)),
+                    );
+                    self.host.viewers.push(id);
+                }
+            }
+            ChildEvent::ViewerLeft { id, active, max } => {
+                self.host.active = active;
+                self.host.max = max;
+                if self.host.viewers.iter().any(|v| v == &id) {
+                    notify(
+                        "PixelPass — viewer disconnected",
+                        format!("endpoint {} left ({active}/{max})", short_id(&id)),
+                    );
+                    self.host.viewers.retain(|v| v != &id);
+                }
             }
             ChildEvent::Capture { state } => {
                 self.host.capturing = matches!(state, child::CaptureState::Started);

src/gui/tray.rs

@@ -0,0 +1,234 @@
+//! System-tray (StatusNotifierItem) integration for the GUI.
+//!
+//! The tray runs on its **own dedicated thread** with its own current-thread
+//! tokio runtime, fully decoupled from the winit event loop (which owns the
+//! main thread) and from the process-wide `#[tokio::main]` runtime. It talks to
+//! the egui app purely over channels:
+//!
+//!   * tray → app: [`TrayAction`] (Show / Quit), polled each frame.
+//!   * app → tray: [`TrayStatus`] (idle / hosting / viewing), pushed on change.
+//!
+//! Why a separate thread instead of `Handle::current().spawn`: updating the
+//! tray from the egui thread would need `block_on`, which panics when called
+//! from inside the running runtime. Keeping ksni's async wholly on its own
+//! runtime sidesteps that and keeps the frame loop non-blocking.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::mpsc::{Receiver, Sender};
+
+use eframe::egui;
+use ksni::TrayMethods;
+
+/// What the user picked from the tray icon or its menu (tray thread → app).
+pub enum TrayAction {
+    /// Left-click, or the "Show window" item: bring the window back.
+    Show,
+    /// The "Quit" item: really exit (the close button only hides to tray).
+    Quit,
+}
+
+/// What the tray icon's tooltip/menu reflect (app → tray thread).
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum TrayStatus {
+    Idle,
+    Hosting { active: u32, max: u32 },
+    Viewing,
+}
+
+fn status_text(status: TrayStatus) -> String {
+    match status {
+        TrayStatus::Idle => "Idle".to_string(),
+        TrayStatus::Hosting { active, max } => {
+            format!("Hosting — {active} of {max} viewer(s) connected")
+        }
+        TrayStatus::Viewing => "Viewing a stream".to_string(),
+    }
+}
+
+/// Handle held by the egui app for the lifetime of the window. Dropping it
+/// closes the app→tray channel, which ends the tray thread and removes the icon.
+pub struct TrayHandle {
+    /// Menu/icon actions to drain each frame.
+    pub actions: Receiver<TrayAction>,
+    status_tx: tokio::sync::mpsc::UnboundedSender<TrayStatus>,
+    /// Set true once the tray actually registered with a StatusNotifier host.
+    /// The app must not divert the window's close to a tray that never appeared.
+    registered: Arc<AtomicBool>,
+    /// Last status pushed, so we don't spam D-Bus with no-op updates.
+    last_sent: Option<TrayStatus>,
+}
+
+impl TrayHandle {
+    /// Whether a system tray is actually showing our icon. Until this is true,
+    /// hiding the window would strand it with no way back.
+    pub fn registered(&self) -> bool {
+        self.registered.load(Ordering::Acquire)
+    }
+
+    /// Push a status change to the tray, deduped against the last one sent.
+    pub fn set_status(&mut self, status: TrayStatus) {
+        if self.last_sent != Some(status) {
+            let _ = self.status_tx.send(status);
+            self.last_sent = Some(status);
+        }
+    }
+}
+
+struct PixelPassTray {
+    status: TrayStatus,
+    /// ARGB pixmap, so the icon shows even where the themed "pixelpass" name
+    /// can't be resolved (e.g. running the dev binary before `make install`).
+    icon: Vec<ksni::Icon>,
+    actions: Sender<TrayAction>,
+    /// Repaint the (possibly hidden/minimized) window so it wakes to act on a
+    /// tray click — otherwise an idle, hidden window never processes the action.
+    ctx: egui::Context,
+}
+
+impl PixelPassTray {
+    fn notify(&self, action: TrayAction) {
+        let _ = self.actions.send(action);
+        self.ctx.request_repaint();
+    }
+}
+
+impl ksni::Tray for PixelPassTray {
+    fn id(&self) -> String {
+        "pixelpass".to_string()
+    }
+
+    fn title(&self) -> String {
+        "PixelPass".to_string()
+    }
+
+    // Themed icon (matches the installed hicolor/scalable/apps/pixelpass.svg);
+    // icon_pixmap below is the always-works fallback.
+    fn icon_name(&self) -> String {
+        "pixelpass".to_string()
+    }
+
+    fn icon_pixmap(&self) -> Vec<ksni::Icon> {
+        self.icon.clone()
+    }
+
+    fn status(&self) -> ksni::Status {
+        ksni::Status::Active
+    }
+
+    fn tool_tip(&self) -> ksni::ToolTip {
+        ksni::ToolTip {
+            title: "PixelPass".to_string(),
+            description: status_text(self.status),
+            icon_name: "pixelpass".to_string(),
+            icon_pixmap: Vec::new(),
+        }
+    }
+
+    fn activate(&mut self, _x: i32, _y: i32) {
+        self.notify(TrayAction::Show);
+    }
+
+    fn menu(&self) -> Vec<ksni::MenuItem<Self>> {
+        use ksni::menu::{MenuItem, StandardItem};
+        vec![
+            // Non-clickable status line.
+            StandardItem {
+                label: status_text(self.status),
+                enabled: false,
+                ..Default::default()
+            }
+            .into(),
+            MenuItem::Separator,
+            StandardItem {
+                label: "Show window".to_string(),
+                activate: Box::new(|t: &mut Self| t.notify(TrayAction::Show)),
+                ..Default::default()
+            }
+            .into(),
+            StandardItem {
+                label: "Quit PixelPass".to_string(),
+                icon_name: "application-exit".to_string(),
+                activate: Box::new(|t: &mut Self| t.notify(TrayAction::Quit)),
+                ..Default::default()
+            }
+            .into(),
+        ]
+    }
+}
+
+/// Decode the embedded PNG (RGBA) and convert to the ARGB pixmap ksni wants.
+/// Reuses eframe's PNG decoder so we don't take a direct `image` dependency.
+fn load_icon() -> Option<Vec<ksni::Icon>> {
+    let icon =
+        eframe::icon_data::from_png_bytes(include_bytes!("../../assets/pixelpass-256.png")).ok()?;
+    let mut data = icon.rgba; // RGBA8, row-major
+    for px in data.chunks_exact_mut(4) {
+        px.rotate_right(1); // [r,g,b,a] -> [a,r,g,b], network byte order
+    }
+    Some(vec![ksni::Icon {
+        width: icon.width as i32,
+        height: icon.height as i32,
+        data,
+    }])
+}
+
+/// Start the tray on its own thread. Returns a handle for the app to drive it,
+/// or `None` if the icon couldn't be decoded or the thread couldn't spawn (in
+/// which case the GUI simply runs without a tray — close behaves as before).
+pub fn start(ctx: egui::Context) -> Option<TrayHandle> {
+    let icon = load_icon()?;
+    let (action_tx, action_rx) = std::sync::mpsc::channel();
+    let (status_tx, mut status_rx) = tokio::sync::mpsc::unbounded_channel::<TrayStatus>();
+    let registered = Arc::new(AtomicBool::new(false));
+    let registered_thread = registered.clone();
+
+    std::thread::Builder::new()
+        .name("pixelpass-tray".to_string())
+        .spawn(move || {
+            let rt = match tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+            {
+                Ok(rt) => rt,
+                Err(e) => {
+                    tracing::warn!("tray: could not build runtime: {e}");
+                    return;
+                }
+            };
+            rt.block_on(async move {
+                let tray = PixelPassTray {
+                    status: TrayStatus::Idle,
+                    icon,
+                    actions: action_tx,
+                    ctx,
+                };
+                let handle = match tray.spawn().await {
+                    Ok(handle) => handle,
+                    Err(e) => {
+                        // No StatusNotifier host (no system tray) — degrade
+                        // gracefully: the window keeps its normal close.
+                        tracing::warn!("tray: not available, running without it: {e}");
+                        return;
+                    }
+                };
+                registered_thread.store(true, Ordering::Release);
+
+                // Apply status changes until the app drops its sender (on quit),
+                // which ends this loop, the runtime, the thread, and the icon.
+                while let Some(status) = status_rx.recv().await {
+                    let _ = handle
+                        .update(move |t: &mut PixelPassTray| t.status = status)
+                        .await;
+                }
+            });
+        })
+        .ok()?;
+
+    Some(TrayHandle {
+        actions: action_rx,
+        status_tx,
+        registered,
+        last_sent: None,
+    })
+}

src/host/mod.rs

@@ -10,6 +10,7 @@ use anyhow::{Result, bail};
 use iroh::endpoint::{Connection, presets};
 use iroh::{Endpoint, EndpointAddr};
 use iroh_tickets::endpoint::EndpointTicket;
+use std::collections::HashMap;
 use std::time::Duration;
 use tokio::sync::{mpsc, oneshot};
 use tokio_util::sync::CancellationToken;
@@ -23,15 +24,28 @@ use crate::common::{
 use self::pipeline::CaptureHandle;
 use self::quality::EffectiveQuality;
 
-/// Messages from per-viewer tasks to the capture supervisor.
+/// Messages from per-viewer tasks (and the GUI command channel) to the
+/// capture supervisor.
+// The shared `Viewer` suffix is the point — these are all viewer lifecycle
+// messages — so keep the descriptive names.
+#[allow(clippy::enum_variant_names)]
 enum SupervisorMsg {
-    /// A new viewer wants in. Supervisor replies with the local capture
+    /// A new viewer wants in. Supervisor replies with the local capture HTTP
-    /// HTTP port to connect to, or an error string if the host is full or
+    /// port to connect to, or an error string if the host is full or capture
-    /// capture spawn failed.
+    /// spawn failed. `cancel` is the viewer's own token — the supervisor keeps
-    AddViewer(oneshot::Sender<Result<u16, String>>),
+    /// it so a later `KickViewer` can tear this viewer's stream down.
+    AddViewer {
+        id: String,
+        cancel: CancellationToken,
+        reply: oneshot::Sender<Result<u16, String>>,
+    },
     /// A viewer's session ended. Supervisor decrements the count and tears
     /// down capture if it just hit zero.
-    RemoveViewer,
+    RemoveViewer { id: String },
+    /// Host asked (via the GUI command channel) to disconnect a viewer by
+    /// endpoint id. Cancels that viewer's token; the normal teardown path then
+    /// emits the `ViewerLeft`.
+    KickViewer { id: String },
 }
 
 pub async fn run(opts: HostOpts) -> Result<()> {
@@ -113,6 +127,15 @@ pub async fn run(opts: HostOpts) -> Result<()> {
         sup_rx,
     ));
 
+    // Command channel for the GUI front-end: read `kick <endpoint-id>` lines
+    // off stdin. Only when machine-driven (`--output json`) — a human host has
+    // nothing to type here, and we don't want to swallow terminal input. Runs
+    // on a plain OS thread (not a tokio task) so a read parked on stdin can't
+    // hold up runtime shutdown on Ctrl+C; the thread dies with the process.
+    if output::json_enabled() {
+        spawn_kick_listener(sup_tx.clone());
+    }
+
     accept_loop(&endpoint, sup_tx.clone(), cancel.clone()).await;
 
     drop(sup_tx);
@@ -159,9 +182,18 @@ async fn handle_peer(
     cancel: CancellationToken,
 ) {
     let remote = conn.remote_id();
+    let id = remote.to_string();
+    // This viewer's own kill switch: the supervisor holds a clone so a `kick`
+    // can cancel it, and the stream select! below watches it.
+    let peer_cancel = CancellationToken::new();
 
     let (reply_tx, reply_rx) = oneshot::channel();
-    if sup_tx.send(SupervisorMsg::AddViewer(reply_tx)).await.is_err() {
+    let add = SupervisorMsg::AddViewer {
+        id: id.clone(),
+        cancel: peer_cancel.clone(),
+        reply: reply_tx,
+    };
+    if sup_tx.send(add).await.is_err() {
         tracing::warn!(%remote, "supervisor channel closed; dropping peer");
         return;
     }
@@ -182,7 +214,7 @@ async fn handle_peer(
         Ok(s) => s,
         Err(e) => {
             tracing::warn!(%remote, "accept_bi failed: {e:#}");
-            let _ = sup_tx.send(SupervisorMsg::RemoveViewer).await;
+            let _ = sup_tx.send(SupervisorMsg::RemoveViewer { id }).await;
             return;
         }
     };
@@ -193,7 +225,7 @@ async fn handle_peer(
         Ok(t) => t,
         Err(e) => {
             tracing::warn!(%remote, "connect_to_capture failed: {e:#}");
-            let _ = sup_tx.send(SupervisorMsg::RemoveViewer).await;
+            let _ = sup_tx.send(SupervisorMsg::RemoveViewer { id }).await;
             return;
         }
     };
@@ -207,10 +239,34 @@ async fn handle_peer(
         _ = cancel.cancelled() => {
             tracing::info!(%remote, "cancellation during stream");
         }
+        _ = peer_cancel.cancelled() => {
+            tracing::info!(%remote, "kicked by host");
+        }
     }
 
     eprintln!("[pixelpass] viewer disconnected: {remote}");
-    let _ = sup_tx.send(SupervisorMsg::RemoveViewer).await;
+    let _ = sup_tx.send(SupervisorMsg::RemoveViewer { id }).await;
+}
+
+/// Read `kick <endpoint-id>` lines off stdin and forward them to the
+/// supervisor. Runs on a detached OS thread (see the call site for why). Ends
+/// when stdin hits EOF (the GUI closed the pipe) or the supervisor is gone.
+fn spawn_kick_listener(sup_tx: mpsc::Sender<SupervisorMsg>) {
+    use std::io::BufRead;
+    std::thread::spawn(move || {
+        let stdin = std::io::stdin();
+        for line in stdin.lock().lines().map_while(Result::ok) {
+            let Some(id) = line.trim().strip_prefix("kick ") else {
+                continue;
+            };
+            let msg = SupervisorMsg::KickViewer { id: id.trim().to_string() };
+            // blocking_send is valid here: this is a plain thread, not inside
+            // the tokio runtime. An Err means the supervisor closed — stop.
+            if sup_tx.blocking_send(msg).is_err() {
+                break;
+            }
+        }
+    });
 }
 
 /// Owns the single shared CaptureHandle and the active viewer count. Spawns
@@ -225,11 +281,15 @@ async fn supervise(
     mut rx: mpsc::Receiver<SupervisorMsg>,
 ) {
     let mut handle: Option<CaptureHandle> = None;
-    let mut count: u32 = 0;
+    // Active viewers, keyed by endpoint id, holding each one's kill switch.
+    // The count is just `viewers.len()`. (A given endpoint connecting twice is
+    // a non-case here: each viewer process uses a fresh ephemeral identity.)
+    let mut viewers: HashMap<String, CancellationToken> = HashMap::new();
 
     while let Some(msg) = rx.recv().await {
         match msg {
-            SupervisorMsg::AddViewer(reply) => {
+            SupervisorMsg::AddViewer { id, cancel, reply } => {
+                let count = viewers.len() as u32;
                 if count >= max_viewers {
                     let reason =
                         format!("host is full ({count} of {max_viewers} viewers connected)");
@@ -255,16 +315,22 @@ async fn supervise(
                 }
 
                 let port = handle.as_ref().expect("handle was just set").local_port();
-                count += 1;
+                viewers.insert(id.clone(), cancel);
+                let active = viewers.len() as u32;
                 let _ = reply.send(Ok(port));
-                output::emit(output::Event::ViewerCount { active: count, max: max_viewers });
+                output::emit(output::Event::ViewerJoined { id: &id, active, max: max_viewers });
-                tracing::info!(active = count, cap = max_viewers, "viewer joined");
+                tracing::info!(active, cap = max_viewers, "viewer joined");
             }
-            SupervisorMsg::RemoveViewer => {
+            SupervisorMsg::RemoveViewer { id } => {
-                count = count.saturating_sub(1);
+                // A given viewer task only ever sends RemoveViewer once, but the
-                output::emit(output::Event::ViewerCount { active: count, max: max_viewers });
+                // map remove is the source of truth either way.
-                tracing::info!(active = count, cap = max_viewers, "viewer left");
+                if viewers.remove(&id).is_none() {
-                if count == 0
+                    continue;
+                }
+                let active = viewers.len() as u32;
+                output::emit(output::Event::ViewerLeft { id: &id, active, max: max_viewers });
+                tracing::info!(active, cap = max_viewers, "viewer left");
+                if active == 0
                     && let Some(h) = handle.take()
                 {
                     tracing::info!("last viewer left — tearing down capture");
@@ -274,6 +340,17 @@ async fn supervise(
                     });
                 }
             }
+            SupervisorMsg::KickViewer { id } => {
+                match viewers.get(&id) {
+                    // Cancel the viewer's token; its handle_peer select! wakes,
+                    // sends RemoveViewer, and the leave is emitted there.
+                    Some(cancel) => {
+                        tracing::info!(%id, "kicking viewer");
+                        cancel.cancel();
+                    }
+                    None => tracing::debug!(%id, "kick for unknown/already-gone viewer"),
+                }
+            }
         }
     }
 

src/interactive.rs

@@ -13,7 +13,7 @@ pub async fn run(cli: Cli) -> Result<()> {
     let theme = ColorfulTheme::default();
     let choice = Select::with_theme(&theme)
         .with_prompt("What do you want to do?")
-        .items(&[
+        .items([
             "Host (share my screen)",
             "View (watch someone else's screen)",
         ])
@@ -112,7 +112,7 @@ fn pick_quality(theme: &ColorfulTheme) -> Result<Quality> {
 
     let choice = Select::with_theme(theme)
         .with_prompt("What quality should the viewer(s) get?")
-        .items(&items)
+        .items(items)
         .default(0)
         .interact()?;
 
@@ -138,7 +138,7 @@ pub async fn run_reconfigure() -> Result<()> {
 async fn preflight_if_needed(theme: &ColorfulTheme) {
     let mut cfg = config::load().unwrap_or_default();
     match cfg.bandwidth.status {
-        config::BandwidthStatus::Measured | config::BandwidthStatus::Skipped => return,
+        config::BandwidthStatus::Measured | config::BandwidthStatus::Skipped => (),
         config::BandwidthStatus::Unmeasured => {
             eprintln!();
             eprintln!("First-time setup");
@@ -154,7 +154,7 @@ async fn preflight_if_needed(theme: &ColorfulTheme) {
 
             let Ok(choice) = Select::with_theme(theme)
                 .with_prompt("What would you like to do?")
-                .items(&[
+                .items([
                     "Run the bandwidth test (recommended)",
                     "Skip — use the conservative default",
                 ])
@@ -180,7 +180,7 @@ async fn preflight_if_needed(theme: &ColorfulTheme) {
             eprintln!();
             let Ok(choice) = Select::with_theme(theme)
                 .with_prompt("Last bandwidth test failed. Try again?")
-                .items(&[
+                .items([
                     "Yes — retry now",
                     "No — use the conservative default",
                 ])
@@ -341,7 +341,7 @@ pub fn prompt_player() -> Result<Player> {
     let theme = ColorfulTheme::default();
     let choice = Select::with_theme(&theme)
         .with_prompt("Connected. Pick a player to launch")
-        .items(&["mpv", "VLC"])
+        .items(["mpv", "VLC"])
         .default(0)
         .interact()?;
     Ok(if choice == 0 { Player::Mpv } else { Player::Vlc })